Error executing sudo command on CentOS 5.3 vps server

Question

I have a very clean brand new install of CentOS 5.3 running on a vps hosted by linode. After installing the new OS, I did a yum update to apply recent patches. I then did yum install sudo to install sudo (I was surprised it was not installed by default). I edited the sudoers file, and all went well. I log in via ssh as a regular user and use sudo whenever I need to do something that requires root privileges, I think that this is a good practice because it makes me aware that I should be a bit extra cautious when issuing these commands. The problem is whenever I issue a sudo command I get an error message:

audit_log_user_command(): Connection refused

the command is executed, but no record of the command is logged as evidenced by:

grep sudo /var/log/messages

returns only one line referencing the yum install.

Answer 1

The error mentioned is due to the fact that CentOS by default doesn't have auditd compiled in to the kernel. The error is purely a cosmetic fault and can be safely ignored.

I think that one can get rid of the error by compiling a new kernel (> 2.6.23) and enable auditd support by selecting 'CONFIG_AUDIT=y'. Also, updating to a newer version of sudo might do the trick, but as I don't have access to any CentOS machines, YMMV.

Answer 2

On CentOS you should check /var/log/secure not /var/log/messages and ensure that auditd it's started:

# start auditd
/etc/init.d/auditd start

# configure to start on boot
/sbin/chkconfig --level 2345 auditd on

Answer 3

This won't fix this problem, but you should use

su -

I find it less annoying than typing sudo in front of every command, and it should get logged.